CVE-2020-22612 Code injection in n/a
An attacker can execute arbitrary code by exploiting a vulnerability in the MyBB installer's settings file write process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-22612?
CVE-2020-22612 is a critical code injection vulnerability in Mybb Mybb, published on 1 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Installer RCE on settings file write in MyBB before 1.8.22.
Weakness: CWE-94
Which versions are affected by CVE-2020-22612?
1 open source package ship an affected version, including mybb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mybb Bitnami | All versions | 1.8.22 |
Products include Mybb Mybb.
How do I fix CVE-2020-22612?
Upgrade mybb to 1.8.22 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-22612 being exploited?
There is no known exploitation of CVE-2020-22612 in the wild and no public exploit code.
Other vulnerabilities in Mybb Mybb
Sources
Also known as BIT-mybb-2020-22612, GHSA-pm38-4f58-28pj.